help!!! guest works - administrator locked down?



Brad Schmitz
07-09-2005, 11:12 PM
I'm setting up an Internet Cafe' Pc for our customer lounge. I'm using the
"guest" account for they're access/logon. I'm trying to turn off the
"properties" for the START MENU, TASKBAR, AND DESKTOP if possible. All of my
tweaks through the "administrator" have worked for the administrator logon
but the guest still has access. I've used gpedit.msc for most plus a regedit
tweak for the start menu. BUT none of them are affecting the "guest" account
logon. What am I doing wrong??
HP dc5000 w/WinXP SP2. Fresh setup out of the box.

This is what I've done so far:
Guest\Startup\iexplorer

Taskbar and Startup Menu properties\ Start Menu \ Customize \ Advanced tab \
Start menu items - all have been unchecked(off) of set to disabled
from start menu
Moved any critical programs( Idon't want guests access to) or folder from
the "all user" start menu to "administrator"

ADDED;
"HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\
"NoChangesStartMenu" with a value of 1.

Changed; gpedit.msc
User Configuration\Admin Templates\
StartMenu and Taskbar\
Remove Drag & Drop context menus on the Start Menu - enabled
Prevent changes to Taskbar & Start Menu settings - enabled
Remove access to context menus for the Taskbar - enabled

Desktop\
Hide & disable all items on destop - enabled

Control Panel\Display
Remove display in Control Panel - enabled
Hide Desktop tab - enabled
Hide Appearance and Themes tab - enabled
Hide Settings tab - enabled
Hide Screen Saver tab - enabled

I shut down all access for the "administrator" logon but the "guest" account
still works fine. How do I get the reverse to happen. I want to shut down
the "guest" account and have the "administrator" account to work.
I tried to make changes from the guest account but the guest doesn't have
the privledges, so I'm lost.
Can someone please help. I'm obviously new to locking down a desktop for
another user.
Brad

Ramesh, MS-MVP
07-09-2005, 11:13 PM
Hi Brad,

All of the changes you made are per-user settings. To apply the settings to
the Guest profile, you need to load the NTUSER.DAT of the Guest account,
make the necessary changes, and then unload the Hive. Refer these pages for
more information:

Editing the Registry for "other" Users
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm

Load a hive into the registry:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/967e371b-40f8-4562-ac7c-91e8f251d65b.mspx

Example: http://support.microsoft.com/default.aspx?scid=kb;en-us;307016

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


"Brad Schmitz" <justme@gotme.com> wrote in message
news:%23X8z0e0VFHA.2560@TK2MSFTNGP10.phx.gbl...
> I'm setting up an Internet Cafe' Pc for our customer lounge. I'm using the
> "guest" account for they're access/logon. I'm trying to turn off the
> "properties" for the START MENU, TASKBAR, AND DESKTOP if possible. All of
> my
> tweaks through the "administrator" have worked for the administrator logon
> but the guest still has access. I've used gpedit.msc for most plus a
> regedit
> tweak for the start menu. BUT none of them are affecting the "guest"
> account
> logon. What am I doing wrong??
> HP dc5000 w/WinXP SP2. Fresh setup out of the box.
>
> This is what I've done so far:
> Guest\Startup\iexplorer
>
> Taskbar and Startup Menu properties\ Start Menu \ Customize \ Advanced tab
> \
> Start menu items - all have been unchecked(off) of set to disabled
> from start menu
> Moved any critical programs( Idon't want guests access to) or folder from
> the "all user" start menu to "administrator"
>
> ADDED;
> "HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\
> "NoChangesStartMenu" with a value of 1.
>
> Changed; gpedit.msc
> User Configuration\Admin Templates\
> StartMenu and Taskbar\
> Remove Drag & Drop context menus on the Start Menu - enabled
> Prevent changes to Taskbar & Start Menu settings - enabled
> Remove access to context menus for the Taskbar - enabled
>
> Desktop\
> Hide & disable all items on destop - enabled
>
> Control Panel\Display
> Remove display in Control Panel - enabled
> Hide Desktop tab - enabled
> Hide Appearance and Themes tab - enabled
> Hide Settings tab - enabled
> Hide Screen Saver tab - enabled
>
> I shut down all access for the "administrator" logon but the "guest"
> account
> still works fine. How do I get the reverse to happen. I want to shut down
> the "guest" account and have the "administrator" account to work.
> I tried to make changes from the guest account but the guest doesn't have
> the privledges, so I'm lost.
> Can someone please help. I'm obviously new to locking down a desktop for
> another user.
> Brad
>
>

Brad Schmitz
07-09-2005, 11:13 PM
Ramesh,
Thank You! Thank You! Thank You!

I've got the desktop / guest user locked down except for one last thing.
Can "Ctrl-Alt-Del" be locked-out or disabled from being used on that account
also?
Brad


"Ramesh, MS-MVP" <ramesh@online.mvps.org> wrote in message
news:%23RNGuN5VFHA.2172@tk2msftngp13.phx.gbl...
> Hi Brad,
>
> All of the changes you made are per-user settings. To apply the settings
to
> the Guest profile, you need to load the NTUSER.DAT of the Guest account,
> make the necessary changes, and then unload the Hive. Refer these pages
for
> more information:
>
> Editing the Registry for "other" Users
> http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm
>
> Load a hive into the registry:
>
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/967e371b-40f8-4562-ac7c-91e8f251d65b.mspx
>
> Example: http://support.microsoft.com/default.aspx?scid=kb;en-us;307016
>
> --
> Ramesh, Microsoft MVP
> Windows XP Shell/User
> http://windowsxp.mvps.org
>
>
> "Brad Schmitz" <justme@gotme.com> wrote in message
> news:%23X8z0e0VFHA.2560@TK2MSFTNGP10.phx.gbl...
> > I'm setting up an Internet Cafe' Pc for our customer lounge. I'm using
the
> > "guest" account for they're access/logon. I'm trying to turn off the
> > "properties" for the START MENU, TASKBAR, AND DESKTOP if possible. All
of
> > my
> > tweaks through the "administrator" have worked for the administrator
logon
> > but the guest still has access. I've used gpedit.msc for most plus a
> > regedit
> > tweak for the start menu. BUT none of them are affecting the "guest"
> > account
> > logon. What am I doing wrong??
> > HP dc5000 w/WinXP SP2. Fresh setup out of the box.
> >
> > This is what I've done so far:
> > Guest\Startup\iexplorer
> >
> > Taskbar and Startup Menu properties\ Start Menu \ Customize \ Advanced
tab
> > \
> > Start menu items - all have been unchecked(off) of set to
disabled
> > from start menu
> > Moved any critical programs( Idon't want guests access to) or folder
from
> > the "all user" start menu to "administrator"
> >
> > ADDED;
> > "HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\
> > "NoChangesStartMenu" with a value of 1.
> >
> > Changed; gpedit.msc
> > User Configuration\Admin Templates\
> > StartMenu and Taskbar\
> > Remove Drag & Drop context menus on the Start Menu - enabled
> > Prevent changes to Taskbar & Start Menu settings - enabled
> > Remove access to context menus for the Taskbar - enabled
> >
> > Desktop\
> > Hide & disable all items on destop - enabled
> >
> > Control Panel\Display
> > Remove display in Control Panel - enabled
> > Hide Desktop tab - enabled
> > Hide Appearance and Themes tab - enabled
> > Hide Settings tab - enabled
> > Hide Screen Saver tab - enabled
> >
> > I shut down all access for the "administrator" logon but the "guest"
> > account
> > still works fine. How do I get the reverse to happen. I want to shut
down
> > the "guest" account and have the "administrator" account to work.
> > I tried to make changes from the guest account but the guest doesn't
have
> > the privledges, so I'm lost.
> > Can someone please help. I'm obviously new to locking down a desktop for
> > another user.
> > Brad
> >
> >
>

Ramesh, MS-MVP
07-09-2005, 11:13 PM
You're welcome Brad.

>> Can "Ctrl-Alt-Del" be locked-out

You want to disable Task Manager? use DisableTaskMgr policy.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


"Brad Schmitz" <justme@gotme.com> wrote in message
news:OEXNOF$VFHA.2424@TK2MSFTNGP10.phx.gbl...
> Ramesh,
> Thank You! Thank You! Thank You!
>
> I've got the desktop / guest user locked down except for one last thing.
> Can "Ctrl-Alt-Del" be locked-out or disabled from being used on that
> account
> also?
> Brad
>
>
> "Ramesh, MS-MVP" <ramesh@online.mvps.org> wrote in message
> news:%23RNGuN5VFHA.2172@tk2msftngp13.phx.gbl...
>> Hi Brad,
>>
>> All of the changes you made are per-user settings. To apply the settings
> to
>> the Guest profile, you need to load the NTUSER.DAT of the Guest account,
>> make the necessary changes, and then unload the Hive. Refer these pages
> for
>> more information:
>>
>> Editing the Registry for "other" Users
>> http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm
>>
>> Load a hive into the registry:
>>
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/967e371b-40f8-4562-ac7c-91e8f251d65b.mspx
>>
>> Example: http://support.microsoft.com/default.aspx?scid=kb;en-us;307016
>>
>> --
>> Ramesh, Microsoft MVP
>> Windows XP Shell/User
>> http://windowsxp.mvps.org
>>
>>
>> "Brad Schmitz" <justme@gotme.com> wrote in message
>> news:%23X8z0e0VFHA.2560@TK2MSFTNGP10.phx.gbl...
>> > I'm setting up an Internet Cafe' Pc for our customer lounge. I'm using
> the
>> > "guest" account for they're access/logon. I'm trying to turn off the
>> > "properties" for the START MENU, TASKBAR, AND DESKTOP if possible. All
> of
>> > my
>> > tweaks through the "administrator" have worked for the administrator
> logon
>> > but the guest still has access. I've used gpedit.msc for most plus a
>> > regedit
>> > tweak for the start menu. BUT none of them are affecting the "guest"
>> > account
>> > logon. What am I doing wrong??
>> > HP dc5000 w/WinXP SP2. Fresh setup out of the box.
>> >
>> > This is what I've done so far:
>> > Guest\Startup\iexplorer
>> >
>> > Taskbar and Startup Menu properties\ Start Menu \ Customize \ Advanced
> tab
>> > \
>> > Start menu items - all have been unchecked(off) of set to
> disabled
>> > from start menu
>> > Moved any critical programs( Idon't want guests access to) or folder
> from
>> > the "all user" start menu to "administrator"
>> >
>> > ADDED;
>> > "HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\
>> > "NoChangesStartMenu" with a value of 1.
>> >
>> > Changed; gpedit.msc
>> > User Configuration\Admin Templates\
>> > StartMenu and Taskbar\
>> > Remove Drag & Drop context menus on the Start Menu - enabled
>> > Prevent changes to Taskbar & Start Menu settings - enabled
>> > Remove access to context menus for the Taskbar - enabled
>> >
>> > Desktop\
>> > Hide & disable all items on destop - enabled
>> >
>> > Control Panel\Display
>> > Remove display in Control Panel - enabled
>> > Hide Desktop tab - enabled
>> > Hide Appearance and Themes tab - enabled
>> > Hide Settings tab - enabled
>> > Hide Screen Saver tab - enabled
>> >
>> > I shut down all access for the "administrator" logon but the "guest"
>> > account
>> > still works fine. How do I get the reverse to happen. I want to shut
> down
>> > the "guest" account and have the "administrator" account to work.
>> > I tried to make changes from the guest account but the guest doesn't
> have
>> > the privledges, so I'm lost.
>> > Can someone please help. I'm obviously new to locking down a desktop
>> > for
>> > another user.
>> > Brad
>> >
>> >
>>
>
>


help!!! guest works - administrator locked down?